标签：ec2   city   color   4.4   location   shadow   sign   --   SSL密钥对   

查看网站ip

用qq.com的两个ip去做负载均衡111.161.64.48 / 111.161.64.40

创建配置文件

[root@100xuni1 vhost]# vim /usr/local/nginx/conf/vhost/ld.conf     ##创建ld.conf 写入下面的内容

upstream qq_com      ##这个名字可以随便写
{
    ip_hash;                         ##目的是为了让同一个用户始终保持在一个机器上
    server 111.161.64.48:80;
    server 111.161.64.40:80;
}
server
{
    listen 80;
    server_name www.qq.com;
    location /
    {
        proxy_pass      http://qq_com;  ##用来指导ip的
        proxy_set_header Host   $host;
        proxy_set_header X-Real-IP      $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

配置完成重新加载

[root@100xuni1 vhost]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@100xuni1 vhost]# /usr/local/nginx/sbin/nginx -s reload

测试

[root@100xuni1 vhost]# curl -x127.0.0.1:80 www.qq.com

ssl原理

生成ssl密钥对

颁发证书，其实就是公钥和私钥

把这对公钥私钥放到 /usr/local/nginx/conf

[root@100xuni1 vhost]# cd /usr/local/nginx/conf/
[root@100xuni1 conf]# 

颁发证书需要一个工具openssl,如果没有安装，用rpm -qf ‘which openssl‘查找安装包

[root@100xuni1 conf]#   openssl genrsa -des3 -out tmp.key 2048    ##genrsa意思是生成rsa格式的，名字tmp.key
Generating RSA private key, 2048 bit long modulus
...............................+++
......+++
e is 65537 (0x10001)
Enter pass phrase for tmp.key:         ##输入密码
Verifying - Enter pass phrase for tmp.key:

[root@100xuni1 conf]# openssl rsa -in tmp.key -out aminglinux.key   ##转换key,取消密码，-in指定哪一个秘钥要被转换-out指定它输出

[root@100xuni1 conf]# rm -f tmp.key  ##删除tmp.key

[root@100xuni1 conf]# openssl req -new -key aminglinux.key -out aminglinux.csr   ##//生成证书请求文件，需要拿这个文件和私钥一起生产公钥文件
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.‘, the field will be left blank.
-----
Country Name (2 letter code) [XX]:11
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:aming
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server‘s hostname) []:aminglinux
Email Address []:admin@adminlinux.com

Please enter the following ‘extra‘ attributes
to be sent with your certificate request
A challenge password []:hanshuo
An optional company name []:aming

[root@100xuni1 conf]# openssl x509 -req -days 365 -in aminglinux.csr -signkey aminglinux.key -out aminglinux.crt   ##生成公钥
Signature ok
subject=/C=11/ST=Beijing/L=Beijing/O=aming/CN=aminglinux/emailAddress=admin@adminlinux.com
Getting Private key

Nginx配置ssl

生成一个新的配置文件

[root@100xuni1 vhost]# vim /usr/local/nginx/conf/vhost/ssl.conf      ##写入一下内容
server
{
    listen 443;
    server_name aming.com;
    index index.html index.php;
    root /data/wwwroot/aming.com;
    ssl on;
    ssl_certificate aminglinux.crt;
    ssl_certificate_key aminglinux.key;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
}

[root@100xuni1 vhost]# mkdir /data/wwwroot/aming.com    ##创建aming.com

如果想正常的访问https必须去买个证书，比如说wotong网站买

扩展
针对请求的uri来代理 http://ask.apelearn.com/question/1049
根据访问的目录来区分后端的web http://ask.apelearn.com/question/920
nginx长连接 http://www.apelearn.com/bbs/thread-65...

49次课（Nginx负载均衡、ssl原理、 生成ssl密钥对、 Nginx配置ssl）

标签：ec2   city   color   4.4   location   shadow   sign   --   SSL密钥对   

原文地址：http://blog.51cto.com/8043410/2160824